Luca c8cb4c88ca harden(messages): SSRF guard on mailbox host, strict sandbox + sanitizer, per-account TLS ...

Pre-upstream review hardening:
- /accounts + /accounts/test now reject private/internal IMAP/SMTP hosts via
  isPrivateIP(), matching /config + /incoming-config (SSRF).
- QueueDetail body iframe uses sandbox="" (script-less, no same-origin) like the
  inbound pane, instead of allow-same-origin.
- /send sanitizer drops the <style> tag + data: scheme to match the stricter
  inbound sanitizeBody allowlist.
- Per-account SMTP transport sets tls.rejectUnauthorized explicitly.

2026-07-07 16:04:11 +02:00

..

public

fix(csp): external bootstrap script to survive strict reverse-proxy CSP (#564)

2026-05-31 22:35:00 +02:00

scripts

…

src

harden(messages): SSRF guard on mailbox host, strict sandbox + sanitizer, per-account TLS

2026-07-07 16:04:11 +02:00

.dockerignore

…

.env.example

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

.env.production.example

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

.gitignore

…

audit-frontend.json

…

docker-entrypoint.sh

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

Dockerfile

chore(security): bump frontend nginx to r4 — close 4 HTTP/2 & module CVEs

2026-07-02 17:14:29 +02:00

Dockerfile.dev

…

Dockerfile.prod

…

eslint.config.js

…

i18next.config.ts

…

index.html

fix(branding): point HTML favicon link at /favicon.ico (the real Safari fix)

2026-06-03 19:01:55 +02:00

nginx.conf

fix(og): broaden social-crawler coverage (Bluesky Cardyb, WeChat-scraper, fediverse, etc.)

2026-07-05 23:37:16 +02:00

nginx.dev.conf

fix(nginx): honour outer X-Forwarded-Proto when behind a reverse proxy (#547)

2026-05-22 13:32:01 +02:00

package-lock.json

chore(security): close 27 code-scanning alerts via dep + base-image bumps

2026-06-29 23:26:32 +02:00

package.json

chore(main): release 3.82.3-beta.0 (#758)

2026-07-06 09:53:29 +00:00

postcss.config.js

…

tailwind.config.js

…

tsconfig.app.json

…

tsconfig.json

…

tsconfig.node.json

…

vite.config.ts

feat(crm): frontend code — pages + services + components

2026-05-26 18:19:32 +02:00

vitest.setup.ts

…